Detects suspicious user agent string of APT40 Dropbox tool

Read More

Detects DNS queries for anonfiles.com, which is an anonymous file upload platform often used for malicious purposes

Read More

Detects DNS queries for "anonfiles.com", which is an anonymous file upload platform often used for malicious purposes

Read More

Detects DNS queries for subdomains related to MEGA sharing website

Read More

Detects DNS queries for subdomains related to MEGA sharing website

Read More

Detects DNS queries to "ufile.io", which was seen abused by malware and threat actors as a method for data exfiltration

Read More

Detects DNS queries to "ufile.io", which was seen abused by malware and threat actors as a method for data exfiltration

Read More

Detects execution of RClone utility for exfiltration as used by various ransomwares strains like REvil, Conti, FiveHands, etc

Read More

Detects the use of rclone, a command-line program to manage files on cloud storage, via its default user-agent string

Read More

Detects Rclone config files being created

Read More

Detection of a exfiltration activity using rclone from Windows network shares using SMB.

Read More

Detects DNS queries for subdomains used for upload to ufile.io

Read More